| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-Id: <200612031918.58175.IvDoorn@gmail.com>
Date: Sun, 3 Dec 2006 19:18:57 +0100
From: Ivo van Doorn <ivdoorn@...il.com>
To: "John W. Linville" <linville@...driver.com>
Cc: netdev@...r.kernel.org
Subject: [PATCH 21/26] rt2x00: Fix txdone race condition
Always call ieee80211_wake_queue if the ring
is not full after the txrun. The ieee80211_wake_queue
is responsible for chacking if the queue was stopped
or not.
The current implementation of checking the ring_full
before the txdone run was flawed and race conditions
could occur that blocked all tx handling.
Signed-off-by Ivo van Doorn <IvDoorn@...il.com>
---
diff -rU3 wireless-dev-led/drivers/net/wireless/d80211/rt2x00/rt2400pci.c wireless-dev-ringfull/drivers/net/wireless/d80211/rt2x00/rt2400pci.c
--- wireless-dev-led/drivers/net/wireless/d80211/rt2x00/rt2400pci.c 2006-12-03 15:09:41.000000000 +0100
+++ wireless-dev-ringfull/drivers/net/wireless/d80211/rt2x00/rt2400pci.c 2006-12-03 15:14:07.000000000 +0100
@@ -1613,14 +1613,8 @@
u32 word;
int tx_status;
int ack;
- int ring_full;
int rts;
- /*
- * Store the current status of the ring.
- */
- ring_full = rt2x00_ring_full(ring);
-
while (!rt2x00_ring_empty(ring)) {
entry = rt2x00_get_data_entry_done(ring);
txd = rt2x00_desc_addr(entry);
@@ -1687,7 +1681,7 @@
* is reenabled when the txdone handler has finished.
*/
entry = ring->entry;
- if (ring_full && !rt2x00_ring_full(ring))
+ if (!rt2x00_ring_full(ring))
ieee80211_wake_queue(rt2x00dev->hw,
entry->tx_status.control.queue);
}
diff -rU3 wireless-dev-led/drivers/net/wireless/d80211/rt2x00/rt2500pci.c wireless-dev-ringfull/drivers/net/wireless/d80211/rt2x00/rt2500pci.c
--- wireless-dev-led/drivers/net/wireless/d80211/rt2x00/rt2500pci.c 2006-12-03 15:09:55.000000000 +0100
+++ wireless-dev-ringfull/drivers/net/wireless/d80211/rt2x00/rt2500pci.c 2006-12-03 15:14:05.000000000 +0100
@@ -1776,14 +1776,8 @@
u32 word;
int tx_status;
int ack;
- int ring_full;
int rts;
- /*
- * Store the current status of the ring.
- */
- ring_full = rt2x00_ring_full(ring);
-
while (!rt2x00_ring_empty(ring)) {
entry = rt2x00_get_data_entry_done(ring);
txd = rt2x00_desc_addr(entry);
@@ -1850,7 +1844,7 @@
* is reenabled when the txdone handler has finished.
*/
entry = ring->entry;
- if (ring_full && !rt2x00_ring_full(ring))
+ if (!rt2x00_ring_full(ring))
ieee80211_wake_queue(rt2x00dev->hw,
entry->tx_status.control.queue);
}
diff -rU3 wireless-dev-led/drivers/net/wireless/d80211/rt2x00/rt2500usb.c wireless-dev-ringfull/drivers/net/wireless/d80211/rt2x00/rt2500usb.c
--- wireless-dev-led/drivers/net/wireless/d80211/rt2x00/rt2500usb.c 2006-12-03 15:10:04.000000000 +0100
+++ wireless-dev-ringfull/drivers/net/wireless/d80211/rt2x00/rt2500usb.c 2006-12-03 15:14:10.000000000 +0100
@@ -1753,14 +1753,8 @@
struct urb *urb;
u32 word;
int ack;
- int ring_full;
int rts;
- /*
- * Store the current status of the ring.
- */
- ring_full = rt2x00_ring_full(ring);
-
while (!rt2x00_ring_empty(ring)) {
entry = rt2x00_get_data_entry_done(ring);
txd = rt2x00_txdesc_addr(entry);
@@ -1821,7 +1815,7 @@
* is reenabled when the txdone handler has finished.
*/
entry = ring->entry;
- if (ring_full && !rt2x00_ring_full(ring))
+ if (!rt2x00_ring_full(ring))
ieee80211_wake_queue(rt2x00dev->hw,
entry->tx_status.control.queue);
}
diff -rU3 wireless-dev-led/drivers/net/wireless/d80211/rt2x00/rt61pci.c wireless-dev-ringfull/drivers/net/wireless/d80211/rt2x00/rt61pci.c
--- wireless-dev-led/drivers/net/wireless/d80211/rt2x00/rt61pci.c 2006-12-03 15:10:28.000000000 +0100
+++ wireless-dev-ringfull/drivers/net/wireless/d80211/rt2x00/rt61pci.c 2006-12-03 15:14:18.000000000 +0100
@@ -2235,7 +2235,6 @@
u32 word;
int tx_status;
int ack;
- int ring_full;
int rts;
txd = rt2x00_desc_addr(entry);
@@ -2285,11 +2284,6 @@
CLEAR_FLAG(entry, ENTRY_RTS_FRAME);
entry->skb = NULL;
- /*
- * Store the current status of the ring.
- */
- ring_full = rt2x00_ring_full(entry->ring);
-
rt2x00_ring_index_done_inc(entry->ring);
/*
@@ -2297,7 +2291,8 @@
* we must make sure the packet queue in the d80211 stack
* is reenabled when the txdone handler has finished.
*/
- if (ring_full && !rt2x00_ring_full(entry->ring))
+ entry = ring->entry;
+ if (!rt2x00_ring_full(ring))
ieee80211_wake_queue(rt2x00dev->hw,
entry->tx_status.control.queue);
}
diff -rU3 wireless-dev-led/drivers/net/wireless/d80211/rt2x00/rt73usb.c wireless-dev-ringfull/drivers/net/wireless/d80211/rt2x00/rt73usb.c
--- wireless-dev-led/drivers/net/wireless/d80211/rt2x00/rt73usb.c 2006-12-03 14:52:44.000000000 +0100
+++ wireless-dev-ringfull/drivers/net/wireless/d80211/rt2x00/rt73usb.c 2006-12-03 15:14:33.000000000 +0100
@@ -2026,14 +2026,8 @@
struct urb *urb;
u32 word;
int ack;
- int ring_full;
int rts;
- /*
- * Store the current status of the ring.
- */
- ring_full = rt2x00_ring_full(ring);
-
while (!rt2x00_ring_empty(ring)) {
entry = rt2x00_get_data_entry_done(ring);
txd = rt2x00_desc_addr(entry);
@@ -2096,7 +2090,7 @@
* is reenabled when the txdone handler has finished.
*/
entry = ring->entry;
- if (ring_full && !rt2x00_ring_full(ring))
+ if (!rt2x00_ring_full(ring))
ieee80211_wake_queue(rt2x00dev->hw,
entry->tx_status.control.queue);
}
-
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Powered by blists - more mailing lists